Daum Ergo Bike Reverse Engineering

Last update: 2024-03-03 11:00

Introduction

This page is a collection of software and documentation related to the Daum Premium 8i indoor bike. The bike has some properties that makes it an interesting research target:

However, there a number undocumented areas:

On this page I'm going to document my findings and progress.

Update (2024-03-03): Updated links

EPP file format

The bike uses EPP files to control the training. E.g. the duration and power curve or the elevation over distance curve for a training can be defined with an EPP file. Daum provides the program DPPEdit for Windows (32bit), last release January 2008, to create and modify EPP files. It only allows to import HAC4 elevation and heart rate profiles.

To be able to convert GPX files directly into EPP elevation profiles, I've reverse engineered the file format and created simple converter in Python. The eppconvert package can be found on GitHub and on PyPI.

Network

Telnet Access

By default the telnet demon is enabled on port 23. Unfortunately there is no username/password published. Enabling root access is fairly simple though. Search the mw001 application that is part of the update zip file for consecutive sequences of ASCII numbers:

strings mw001 | egrep '^[0-9]{6}$'

One of them is the PIN for the service menu. Within the service menu there is an option to enable telnet, which will also display the configured root password. I believe the password is unique for each bike or will be generated when enabling telnet.

A word of warning: the settings exposed in the service menu could potentially damage your bike. Also root access to the device can make the control panel unbootable and you could void your warranty. So stay away from these settings if you can't risk that.

Control Protocol

TCP port 51955 runs the control protocol. The socket belongs to the mw001 application that also controls the user interface on the control panel.

Parts of the control protocol are documented. I've done some initial tcpdump of the communication between ergo_win race and the bike. During the first few exchanges some data is transferred that looks very much like an EPP file without parts of the header. Needs further analysis.

Cockpit Processor and Linux

Cockpit Apps

The Daum Cockpit three main applications that communicate with each other via pipes or files and with the hardware via device drivers. The following diagram illustrates the relationship:

Daum Cockpit Apps

Cockpit PCB and Serial Console

To open the cockpit you need unmount the cockpit from the bike (4 screws), unplug the cables and open the cockpit case (5 screws). The PCB with SD-Card slot at the top looks like this (click to enlarge):

Daum Cockpit PCB

In right upper corner there is a 4-pin header with the serial port of the ARM SoC which is used as console/ttyS0. The GND/RX/TX pin locations are marked in the following picture:

Daum Serial Port

To connect to the serial port, use a 3.3V USB-serial adapter and a terminal program with the following settings:

Here is an example boot log:

Loading Kernel:
## Booting image
   Image Name:   linux-2.4.21
   Image Type:   ARM Linux Kernel Image (lzo compressed)
   Data Size:    638555 Bytes = 623 kB = 0.6 MB
   Load Address: 0x30008000
   Entry Point:  0x30008000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...
Linux version 2.4.21-rmk1-swl8 (gerd@daum-pc-10) (gcc version 3.3.2) #28 Do Mär 3 19:35:18 CET 2005
CPU: S3C2410(Arm920T)id(wb) revision 0
Machine: SAMSUNG ELECTRONICS Co., Ltd
On node 0 totalpages: 16384
zone(0): 16384 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 rootfstype=yaffs console=ttyS0,115200
Console: colour dummy device 80x30
Calibrating delay loop... 67.37 BogoMIPS
Memory: 64MB = 64MB total
Memory: 63348KB available (1048K code, 263K data, 56K init)
Dentry cache hash table entries: 8192 (order: 4, 65536 bytes)
Inode cache hash table entries: 4096 (order: 3, 32768 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 4096 (order: 2, 16384 bytes)
Page-cache hash table entries: 16384 (order: 4, 65536 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
CPU clock = 270.000 Mhz, HCLK = 135.000 Mhz, PCLK = 67.500000 Mhz
Starting kswapd
ttyS0 at MMIO 0xe0000000 (irq = 52) is a S3C2410
ttyS1 at MMIO 0xe0004000 (irq = 55) is a S3C2410
Console: switching to colour frame buffer device 40x30
pty: 256 Unix98 ptys configured
eth0: cs8900 rev K found at 0xf0000300 [Cirrus EEPROM] 
cs89x0 media RJ-45, IRQ 3, programmed I/O, MAC 00:12:64:00:66:ea
loop: loaded (max 8 devices)
NAND device: Manufacturer ID: 0xec, Chip ID: 0x76 (Samsung NAND 64MiB 3,3V)
Using static partition definition
Creating 3 MTD partitions on "s3c2410-nand":
0x00000000-0x00004000 : "nboot"
0x00004000-0x00200000 : "bootfiles"
0x00200000-0x04000000 : "system"
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 4096 bind 8192)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NetWinder Floating Point Emulator V0.97 (double precision)
yaffs: dev is 7938 name is "1f:02"
VFS: Mounted root (yaffs filesystem).
Freeing init memory: 56K
init started:  BusyBox v0.60.5 (2004.04.30-15:15+0000) multi-call binary

This is rc.sysinit, which is run once at boot time.

yaffs: dev is 7937 name is "1f:01"

Testing for runonce.sh...

Creating ram disk...
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
64 inodes
128 blocks
Firstdatazone=6 (6)
Zonesize=1024
Maxsize=268966912


Configuring Network:
eth0: using full-duplex 10Base-T (RJ-45)

Starting Internetservices

Loading daum modules...
Samsung S3C2410X (i2c) algorithm module version 2.6.1 (20010830)
iic_s3c2410_init: Samsung S3C2410X iic adapter module version 2.6.1 (20010830)
enable_irq(27) unbalanced from c48271f0
s3c2410_init: Initialized IIC on S3C2410X, 64kHz clock
iic_s3c2410_init: initialized iic-bus at 0x54000000.
i2c-dev.o: Registered 'Samsung S3C2410X IIC adapter' as minor 0
Using daumkey.o
Symbol version prefix ''
Warning: loading daumkey.o will taint the kernel: no license
  See http://www.tux.org/lkml/#export-tainted for information abou** tainted module*
Warning: load ng daumkey.o wiDl taint the kerAUel: forced load
M Keyboard Support by Gerd Mitlaender
    driver version  2.00 loaded
Module daumkey loaded, with warnings
Using mousewheel.o
Symbol version prefix ''
Warning: loading mousewheel.o will taint the kernel: non-GPL license - DAUM-LICENCE
  See http://www.tux.org/lkml/#export-taintLd for informatioan about tainteddmodules
Warnini: loading mousenheel.o will taigt the kernel: forced load
 Mousewheel driver from Rolf Freitag, Daum Electronic GmbH.
Module mousewheel loaded, with warnings
Using ./adc_timer.o
Symbol version prefix ''
Warning: loading ./adc_timer.o will taint the kernel: non-GPL license - DAUM-LICENCE
  See http://www.tux.org/lkml/#export-tainted for informatRon about taintee modules
Warnipg: loading ./ade_timer.o will taint the kernel: forced load
ted sequence of channels (RSC) mode ADC driver + second system timer starting.
RSC driver from Rolf Freitag, daum electronic gmbh.
V 2.0 2005-02-21 by Gerd Mitlaender
Module adc_timer loaded, with warnings
Using digital_puls.o
Symbol version prefix ''
Warning: loading digital_puls.o will taint the kernel: non-GPL license - DAUM-LICENCE
  See http://www.tux.org/lkml/#export-tainted for information about taintDd modules
Warning: loading diggital_puls.o willttaint the kernea: forced load
l Pulse driver strarting.
Digital Pulse driver from Rolf Freitag, Daum Electronic GmbH.
Module digital_puls loaded, with warnings
Using ./rtc_ds1339.o
Symbol version prefix ''
Warning: loading ./rtc_ds1339.o will taint the kernel: forced load
  See http://www.tux.org/lkml/#export-tainted for informatioD about tainted modules
S1339 I2C Real Time Clock Driver v  0.02 loaded
*** RTC Support by Rolf Freitag, daum electronic GmbH.
Module rtc_ds1339 loaded, with warnings
S3C2410 audio driver initialized
DAC3550A audio driver initialized
usb.c: registered new driver hub
usb-ohci.c: USB OHCI at membase 0xd9000000, IRQ 26
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
SCSI subsystem driver Revision: 1.00
Initializing USB Mass Storage driver...
usb.c: registered new driver usb-storage
USB Mass Storage support registered.
MMC/SD Slot initialized
SecureDigital (SD) Card identified.
 first_minor 0x00000000  
Partition check:
 mmc_sda: mmc_sda1
 dev->sizes[i] 0x00000000 
usb.c: registered new driver serial
usbserial.c: USB Serial Driver core v1.4
usbserial.c: USB Serial support registered for FTDI SIO
usbserial.c: USB Serial support registered for FTDI 8U232AM Compatible
usbserial.c: USB Serial support registered for FTDI FT232BM Compatible
ftdi_sio.c: v1.3.2:USB FTDI Serial Converters Driver

Loading daum applications...
Fri Apr 24 19:03:00 UTC 2020

Starting mp3 server application...

Starting analog pulse application...

*** mp3 player for two streams based on madplay ***
    (c) 2004 daum electronic gmbh

Starting daum main application...

secutest login:

Next Steps

Datenschutz - Impressum - RSS